Analysis
-
max time kernel
164s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
07/01/2024, 19:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a813d6c17d580cde14f69211e6896ba8.exe
Resource
win7-20231215-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
a813d6c17d580cde14f69211e6896ba8.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
a813d6c17d580cde14f69211e6896ba8.exe
-
Size
917KB
-
MD5
a813d6c17d580cde14f69211e6896ba8
-
SHA1
d1f89f814eee691442bd74438a6bab8b9c90934f
-
SHA256
45d96504c5914dd8067b8587dfb6c3facb77ed1458231b249cfa03f85a313613
-
SHA512
fd6369a5252c7bf3dbf01fa6615bd2c139ef315d507d08d97bc5e2354db3ed76e8ea86a045f21f895fb3304a19cbc0f6992a7ee601ef29d27af20a8f43a08d76
-
SSDEEP
24576:F1bhaXTHK7ohRqlVvTuQ/SHerQV/QFOfWhpLEBs:FjaXTq7Cq/1eerydWhpLEBs
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe sIRC4.exe" a813d6c17d580cde14f69211e6896ba8.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\DC++ Share\ieinstal.exe a813d6c17d580cde14f69211e6896ba8.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javac.exe a813d6c17d580cde14f69211e6896ba8.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javaw.exe a813d6c17d580cde14f69211e6896ba8.exe File created C:\Windows\SysWOW64\xdccPrograms\ConvertInkStore.exe a813d6c17d580cde14f69211e6896ba8.exe File created C:\Windows\SysWOW64\DC++ Share\OSPPSVC.exe a813d6c17d580cde14f69211e6896ba8.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\appletviewer.exe a813d6c17d580cde14f69211e6896ba8.exe File created C:\Windows\SysWOW64\DC++ Share\extcheck.exe a813d6c17d580cde14f69211e6896ba8.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\idlj.exe a813d6c17d580cde14f69211e6896ba8.exe File created C:\Windows\SysWOW64\xdccPrograms\7zG.exe a813d6c17d580cde14f69211e6896ba8.exe File created C:\Windows\SysWOW64\DC++ Share\chrome_proxy.exe a813d6c17d580cde14f69211e6896ba8.exe File created C:\Windows\SysWOW64\DC++ Share\idlj.exe a813d6c17d580cde14f69211e6896ba8.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javadoc.exe a813d6c17d580cde14f69211e6896ba8.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\ShapeCollector.exe a813d6c17d580cde14f69211e6896ba8.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\apt.exe a813d6c17d580cde14f69211e6896ba8.exe File created C:\Windows\SysWOW64\DC++ Share\master_prefere.exe a813d6c17d580cde14f69211e6896ba8.exe File created C:\Windows\SysWOW64\DC++ Share\javap.exe a813d6c17d580cde14f69211e6896ba8.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\ielowutil.exe a813d6c17d580cde14f69211e6896ba8.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\java.exe a813d6c17d580cde14f69211e6896ba8.exe File created C:\Windows\SysWOW64\DC++ Share\MSOXMLED.exe a813d6c17d580cde14f69211e6896ba8.exe File created C:\Windows\SysWOW64\DC++ Share\jar.exe a813d6c17d580cde14f69211e6896ba8.exe File created C:\Windows\SysWOW64\DC++ Share\java-rmi.exe a813d6c17d580cde14f69211e6896ba8.exe File created C:\Windows\SysWOW64\DC++ Share\javah.exe a813d6c17d580cde14f69211e6896ba8.exe File created C:\Windows\SysWOW64\xdccPrograms\7zFM.exe a813d6c17d580cde14f69211e6896ba8.exe File created C:\Windows\SysWOW64\xdccPrograms\InkWatson.exe a813d6c17d580cde14f69211e6896ba8.exe File created C:\Windows\SysWOW64\xdccPrograms\mip.exe a813d6c17d580cde14f69211e6896ba8.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\iediagcmd.exe a813d6c17d580cde14f69211e6896ba8.exe File created C:\Windows\SysWOW64\DC++ Share\appletviewer.exe a813d6c17d580cde14f69211e6896ba8.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\java-rmi.exe a813d6c17d580cde14f69211e6896ba8.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javah.exe a813d6c17d580cde14f69211e6896ba8.exe File created C:\Windows\SysWOW64\DC++ Share\javaws.exe a813d6c17d580cde14f69211e6896ba8.exe File created C:\Windows\SysWOW64\xdccPrograms\Uninstall.exe a813d6c17d580cde14f69211e6896ba8.exe File created C:\Windows\SysWOW64\xdccPrograms\InputPersonalization.exe a813d6c17d580cde14f69211e6896ba8.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\chrmstp.exe a813d6c17d580cde14f69211e6896ba8.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCX80C.tmp a813d6c17d580cde14f69211e6896ba8.exe File created C:\Windows\SysWOW64\DC++ Share\msinfo32.exe a813d6c17d580cde14f69211e6896ba8.exe File created C:\Windows\SysWOW64\DC++ Share\elevation_service.exe a813d6c17d580cde14f69211e6896ba8.exe File opened for modification C:\Windows\SysWOW64\sIRC4.exe a813d6c17d580cde14f69211e6896ba8.exe File created C:\Windows\SysWOW64\DC++ Share\chrome.exe a813d6c17d580cde14f69211e6896ba8.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\chrome.exe a813d6c17d580cde14f69211e6896ba8.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\jabswitch.exe a813d6c17d580cde14f69211e6896ba8.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\jarsigner.exe a813d6c17d580cde14f69211e6896ba8.exe File created C:\Windows\SysWOW64\DC++ Share\javaw.exe a813d6c17d580cde14f69211e6896ba8.exe File created C:\Windows\SysWOW64\DC++ Share\VSTOInstaller.exe a813d6c17d580cde14f69211e6896ba8.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\VSTOInstaller.exe a813d6c17d580cde14f69211e6896ba8.exe File created C:\Windows\SysWOW64\DC++ Share\DVDMaker.exe a813d6c17d580cde14f69211e6896ba8.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\DVDMaker.exe a813d6c17d580cde14f69211e6896ba8.exe File created C:\Windows\SysWOW64\DC++ Share\setup.exe a813d6c17d580cde14f69211e6896ba8.exe File created C:\Windows\SysWOW64\DC++ Share\jabswitch.exe a813d6c17d580cde14f69211e6896ba8.exe File created C:\Windows\SysWOW64\DC++ Share\jarsigner.exe a813d6c17d580cde14f69211e6896ba8.exe File created C:\Windows\SysWOW64\DC++ Share\javadoc.exe a813d6c17d580cde14f69211e6896ba8.exe File created C:\Windows\SysWOW64\xdccPrograms\7z.exe a813d6c17d580cde14f69211e6896ba8.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\7zG.exe a813d6c17d580cde14f69211e6896ba8.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\notification_helper.exe a813d6c17d580cde14f69211e6896ba8.exe File created C:\Windows\SysWOW64\DC++ Share\iediagcmd.exe a813d6c17d580cde14f69211e6896ba8.exe File created C:\Windows\SysWOW64\DC++ Share\ielowutil.exe a813d6c17d580cde14f69211e6896ba8.exe File created C:\Windows\SysWOW64\DC++ Share\iexplore.exe a813d6c17d580cde14f69211e6896ba8.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javaws.exe a813d6c17d580cde14f69211e6896ba8.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\ConvertInkStore.exe a813d6c17d580cde14f69211e6896ba8.exe File created C:\Windows\SysWOW64\DC++ Share\TabTip.exe a813d6c17d580cde14f69211e6896ba8.exe File created C:\Windows\SysWOW64\DC++ Share\ShapeCollector.exe a813d6c17d580cde14f69211e6896ba8.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\OSPPSVC.exe a813d6c17d580cde14f69211e6896ba8.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\master_prefere.exe a813d6c17d580cde14f69211e6896ba8.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\extcheck.exe a813d6c17d580cde14f69211e6896ba8.exe File created C:\Windows\SysWOW64\DC++ Share\javafxpackager.exe a813d6c17d580cde14f69211e6896ba8.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
956KB
MD5b1c1cc15842322a6c49d7748477219af
SHA15332f72815ca60e82078cea4633afa478aeaba5e
SHA2560eaff5f0caafdb0ff6f9456f0cfe26b76e26f43540aba2f2373f9d921b87a2cb
SHA51293e90ad11884b4ff8bf9cfc4196e7cc14d1c068cb55c679177c0919cae92d5725b01f22e62cd1ff99890cf6934a1bcfd595c0fedf8a6af0623b4bef639fe45dc